Harden export preview handling

2026-06-17 07:04:07 +02:00
parent 21b84dae6c
commit ff21911ac5
10 changed files with 111 additions and 15 deletions
@@ -259,6 +259,28 @@ def test_export_content_reads_persisted_artifact(tmp_path) -> None:
    assert response.content == {"hello": "world"}


+def test_export_content_rejects_html_report_preview(tmp_path) -> None:
+    export_id = uuid4()
+    export_path = tmp_path / "report.html"
+    export_path.write_text("<!doctype html><html><body>report</body></html>", encoding="utf-8")
+    export = Export(
+        id=export_id,
+        project_id=uuid4(),
+        export_type="project_report_html",
+        storage_path=str(export_path),
+        metadata_json={"format": "html"},
+    )
+    db = FakeSession({(Export, export_id): export})
+
+    try:
+        ExportService.get_export_content(db, export_id)
+    except AppError as exc:
+        assert exc.code == "EXPORT_CONTENT_UNSUPPORTED"
+        assert exc.status_code == 415
+    else:
+        raise AssertionError("HTML report artifacts must be download-only through the content preview API")
+
+
 def test_export_download_path_rejects_missing_artifact(tmp_path) -> None:
    export_id = uuid4()
    export = Export(